| title | description | ms.assetid | ms.tgt_platform | ms.topic | ms.date | topic_type | api_name | api_type | api_location | |
|---|---|---|---|---|---|---|---|---|---|---|
Events (Windows Remote Management) |
The Event Collector service uses the WS-Management protocol to collect events from remote computers. |
5c8e0559-c576-4ac6-b636-c4a6fc399c9f |
multiple |
article |
05/31/2018 |
|
The Event Collector service uses the WS-Management protocol to collect events from remote computers. With the Event Collector service, you can create subscriptions to Windows events on remote computers and hardware events generated by baseboard management controllers (BMCs). BMCs must support the WS-Management protocol.
When you create a subscription, the events are forwarded to the computer on which the subscription has been created. They will appear in the Event Viewer.
Hardware events generated by Intelligent Platform Management Interface (IPMI) on Windows-based computers are collected locally using the IPMI driver and stored in the Hardware Events log, after which they can be forwarded like other Windows operating system events.
You can create subscriptions by using the Wecutil.exe command-line tool. For more information about how to use this tool, at a command prompt type wecutil /?. For more information about the Event Collector service, see Windows Event Collector.
Note
Windows Remote Management APIs require that all IPv6 addresses are enclosed in square brackets.
Caution
When using Collector-initiated subscriptions, limit the number of remote computers to 500 and isolate the Windows Event Collector service (wecsvc) in a separate host process.
A connection error will hold a thread until it times out. A large number of simultaneous connection errors can cause thread pool exhaustion and render the server unresponsive.